Data processing method, device and equipment and machine readable storage medium

Abstract

The invention provides a data processing method and device, equipment and a machine readable storage medium. The method comprises the following steps: receiving a security alarm log; classifying the security alarm logs associated with the same attack source IP into a group, and calculating attack features associated with the attack source IP associated with the group of security alarm logs by a preset rule according to the security alarm logs of the same group; and carrying out clustering calculation according to the attack features associated with each attack source IP, and obtaining an attacker portrait according to a calculation result. Through the technical scheme disclosed by the invention, the security alarm reported by the security equipment is analyzed according to the attack event of each attack source, the attack behavior characteristics of the attack source on a single target are extracted, then the attack behaviors of the attack source on a plurality of attack targets are calculated and analyzed, the attack behavior characteristics of the attack source are extracted, and on the basis, the attack sources are classified by utilizing clustering calculation, the attacker portrait is finally obtained, the efficiency is high, and the portrait is accurate.

Description

technical field [0001] The present disclosure relates to the technical field of communications, and in particular, to a data processing method, device, device, and machine-readable storage medium. Background technique [0002] Network security is getting more and more attention in today's era, and border defense equipment has become the standard equipment for enterprise information construction. In the face of increasing network security attacks, identifying the attack behavior characteristics of attackers is a topic of concern in the network security industry. It has considerable research value for increasing external attack predictions and identifying attackers' attack methods. [0003] K-means is a commonly used clustering algorithm based on Euclidean distance, which believes that the closer the distance between two targets, the greater the similarity. [0004] The LCS (Long Common Sequence, longest common subsequence) algorithm is used to find the longest common substri...

AI Technical Summary

Problems solved by technology

[0007] In view of this, the present disclosure provides a data processing method, device, electronic device, and machine-readable storage medium, so as to improve the above-mentioned problem of ineffective acquisition of attacker portraits

Images